I have a custom API for my native Flutter app. The API is used to create User accounts, so I cannot authenticate users individually based on user accounts.
Currently I use a universal API Key which is embedded into the app.
I use firebase, which requires to allow our SHA1 fingerprints in the web console. Can I use the same mechanism in my backend? Can I sign text/requests with the build certificate?
Or is there a different way to restrict API abuse?